🔺Severity: Critical
👽 Reporter: benisprlh
⭐️ Reputation: 137
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-21
⏰ Disclosed: 2026-08-05 05:05:49
📝 Summary: The
relay tx wallet-RPC method in Monero was found to bypass the --restricted-rpc guard, allowing any caller to corrupt the wallet state by submitting a malicious pending tx blob. The issue was that the on relay tx handler did not perform any ownership checks on the supplied pending tx before passing it to commit tx, which then updated the wallet state based on the attacker-controlled data. This vulnerability was introduced in the master branch and was present at the time of the commit analyzed.📂 Report JSON File: 3687543
@hackeronereports